PT-2026-33115 · Weblate · Weblate

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-33220

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17

Description The translation memory API exposes unintended endpoints that lack proper access control.

Recommendations Update to version 5.17. As a temporary workaround, ensure the CDN add-on remains disabled.

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

CVE-2026-33220

GHSA-MQPH-7H49-HQFM

PYSEC-2026-153

Affected Products

Weblate

References · 8

• https://github.com/WeblateOrg/weblate/pull/18516 · Patch
• https://osv.dev/vulnerability/GHSA-mqph-7h49-hqfm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33220 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-153 · Vendor Advisory
• https://github.com/WeblateOrg/weblate · Note
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-mqph-7h49-hqfm · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/weblate/PYSEC-2026-153.yaml · Note
• https://twitter.com/CVEnew/status/2044737943777034664 · Twitter Post